CVE-2026-101047: Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fleetto a version that resolves this vulnerability.Fixed in 4.87.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only Fleet enterprise-tier deployments before 4.87.0 that serve in-house iOS application packages and manifests are affected. The free tier is unaffected and returns fleet.ErrMissingLicense.
What does an attacker need to exploit this issue?
An attacker needs network access to the Fleet server and must guess sequential title identifiers used in the download URLs. No Fleet session or other authentication is required.
What information can be exposed?
An attacker can download in-house iOS IPA binaries and associated manifest metadata, including the bundle identifier, version, and application name. The issue provides read-only disclosure and does not grant write access or privilege escalation.
How can I determine whether my instance is exposed?
An instance is exposed if it is an enterprise-tier Fleet deployment before 4.87.0 with in-house iOS application packages or manifests available through the affected endpoints. The relevant URLs can be reached without a Fleet session because they must support Apple's InstallEnterpriseApplication MDM command.